Repository navigation
Support Linear MCP access modes and authentication URLs - #13
Merged
Merged
Conversation
tpetr
changed the title
Friss
approved these changes
Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an
access_modeinput to the Linear MCP module so callers can choose read-only or read-write tools. Preserveread-onlyas the module default for existing consumers. The launcher passes the selected mode to the adapter, which chooses only between Linear's fixed official/mcp/readonlyand/mcpendpoints; arbitrary endpoints and redirects remain unsupported.Read-write also requires a write-capable OAuth grant. The module does not alter OAuth configuration or token permissions. Restart MCP clients after changing mode. Optional authentication and per-request token refresh are unchanged.
Validation: twelve adapter tests and six Terraform mock-provider tests pass, including both endpoints, the backward-compatible default, and invalid mode rejection. Terraform formatting and validation pass. No live write operations were performed; the current account's read-only grant needs reauthorization before writes can be exercised.
When Coder reports an unlinked account, preserve the validated Coder linking-page URL and include it in tool error replies and one-time stderr guidance. Strip query parameters and never relay raw CLI output/errors. A missing credential context falls back to the CLI command that retrieves the authentication URL. Tests cover the actual exit-one CLI behavior over stdio.